When can a provider share PHI without a signed authorization?

Under HIPAA, providers may share PHI without authorization for treatment, payment, and healthcare operations (TPO). They may also disclose PHI without authorization in certain public interest situations, such as mandatory disease reporting, court orders, law enforcement requests under specific conditions, and serious threats to health or safety.

Can a patient revoke a HIPAA authorization?

Yes. A patient may revoke a HIPAA authorization at any time by submitting a written revocation to the covered entity. However, revocation does not affect actions already taken in reliance on the authorization. Providers should document the date they received the revocation request.

Are there special rules for mental health or substance use records?

Yes. Mental health records, substance use disorder treatment records (governed by 42 CFR Part 2), HIV/AIDS records, and genetic information are subject to heightened confidentiality protections that may exceed HIPAA requirements. A general HIPAA authorization may not be sufficient for these categories — consult your state's specific laws.

How long is a HIPAA authorization valid?

A HIPAA authorization must include an expiration date or a specific event that causes it to expire (such as 'end of research study'). There is no mandatory minimum or maximum duration under HIPAA, but shorter authorization periods are generally preferable to minimize privacy risk. The patient can always revoke earlier.

Free HIPAA Consent Form — Fill Out & Download Instantly

Free — No Sign-Up RequiredPDF & WordUpdated April 16, 2026

⚠️ Legal Disclaimer: This template is attorney-reviewed and built to US legal standards. It does not substitute for professional legal advice. For complex situations, we recommend consulting a licensed attorney.

Document Completeness10%

Practice / Covered Entity Name*

Practice Address*

Patient Full Name*

Patient Date of Birth*

MM/DD/YYYY

Purpose of Disclosure*

Recipient Name*

Recipient Organization

Description of Information to Be Disclosed*

Be specific about the type and date range of records authorized for release

Authorization Expiration Date*

MM/DD/YYYY

Date after which this authorization is no longer valid

I understand that I have the right to revoke this authorization in writing at any time, except to the extent that action has already been taken in reliance on it.

Date of Authorization*

MM/DD/YYYY

Live Preview

100%

[Practice / Covered Entity Name]

[Practice Address]

════════════════════════════════════════

HIPAA AUTHORIZATION FOR USE OR DISCLOSURE

OF PROTECTED HEALTH INFORMATION

45 CFR § 164.508

════════════════════════════════════════

Patient Name: [Patient Full Name]

Date of Birth: [Patient Date of Birth]

Date: [Date of Authorization]

I. COVERED ENTITY MAKING DISCLOSURE

[Practice / Covered Entity Name]

[Practice Address]

II. RECIPIENT OF INFORMATION

Name: [Recipient Name]

III. DESCRIPTION OF INFORMATION AUTHORIZED FOR DISCLOSURE

[Description of Information to Be Disclosed]

IV. PURPOSE OF DISCLOSURE

[Purpose of Disclosure]

V. EXPIRATION

This authorization expires on: [Authorization Expiration Date]

VI. PATIENT RIGHTS

Right to Revoke: I understand that I may revoke this authorization at any time by submitting a written request to [Practice / Covered Entity Name]. Revocation will not affect actions taken prior to receipt of the revocation.

Voluntary Authorization: I understand that my treatment, payment, enrollment, or eligibility for benefits is not conditioned on signing this authorization, except where permitted by law.

Re-Disclosure Warning: Information disclosed pursuant to this authorization may be re-disclosed by the recipient and may no longer be protected by HIPAA.

SIGNATURE

By signing below, I authorize the use or disclosure of my protected health information as described above.

Patient / Authorized Representative Signature: _______________________________

Printed Name: [Patient Full Name]

Date: [Date of Authorization]

If signing as authorized representative, relationship to patient: _______________

This authorization must be retained in the patient's medical record. A copy should be provided to the patient upon request.

Document Completeness10%

Practice / Covered Entity Name*

Practice Address*

Patient Full Name*

Patient Date of Birth*

MM/DD/YYYY

Purpose of Disclosure*

Recipient Name*

Recipient Organization

Description of Information to Be Disclosed*

Be specific about the type and date range of records authorized for release

Authorization Expiration Date*

MM/DD/YYYY

Date after which this authorization is no longer valid

I understand that I have the right to revoke this authorization in writing at any time, except to the extent that action has already been taken in reliance on it.

Date of Authorization*

MM/DD/YYYY

What Is a HIPAA Consent Form?

A HIPAA consent form (formally known as a HIPAA Authorization under 45 CFR § 164.508) is a written document that authorizes a healthcare provider to use or disclose a patient's protected health information (PHI) for purposes beyond routine treatment, payment, and healthcare operations. While providers can share PHI for treatment purposes without additional authorization, many situations — including disclosures to attorneys, insurers, employers, researchers, or family members — require a patient-signed authorization. This template captures all HIPAA-required elements: the specific information to be disclosed, the identity of the recipient, the purpose of the disclosure, an expiration date, the patient's right to revoke, and a dated signature.

When Do You Need It?

Use a HIPAA consent/authorization form whenever a provider needs to share a patient's protected health information for a purpose not covered by routine treatment, payment, or healthcare operations. Common situations include: releasing medical records to an attorney or court, providing information to an employer or insurance company, disclosing records for research purposes, sharing information with a specialist for a referral, or authorizing a family member to receive health information. Without a signed authorization, disclosure for these purposes violates HIPAA..

What's Included in This Template

Practice name and address
Patient name and date of birth
Purpose of disclosure (treatment, payment, referral, legal, research, or operations)
Recipient name and organization
Description of information to be disclosed
Expiration date of authorization
Patient's right to revoke checkbox and statement
Consent date and patient signature block
Notice that refusal to authorize does not affect treatment
Re-disclosure warning statement

How to Fill It Out

Enter Practice and Patient Information — Fill in the practice name, address, patient's full legal name, and date of birth. This identifies the covered entity and the individual whose information is being authorized for disclosure.

Identify the Recipient and Purpose — Select the purpose of the disclosure from the dropdown and enter the name and organization of the person or entity who will receive the information. Be specific — HIPAA requires that authorizations identify recipients with reasonable specificity.

Describe the Information and Set an Expiration — In the information-to-disclose field, describe what specific health information is authorized for release (e.g., 'all records from January 1, 2025 to present' or 'records related to diagnosis code M54.5'). Enter an expiration date after which the authorization is no longer valid.

Confirm Rights and Sign — The right-to-revoke checkbox is pre-selected to acknowledge the patient's HIPAA right to revoke this authorization in writing at any time. Enter the consent date and obtain the patient's signature.

Legal Requirements & Notes

This form is based on the HIPAA Privacy Rule authorization requirements set forth at 45 CFR § 164.508. A valid HIPAA authorization must include: a description of the information to be used or disclosed, the name or class of persons authorized to make the disclosure, the name or class of persons to whom the disclosure may be made, a description of each purpose, an expiration date or event, and the patient's signature and date. Providers may not condition treatment on the signing of an authorization except in limited circumstances. Note that some states have stricter privacy laws (e.g., for mental health, substance use disorder, HIV/AIDS records) that impose additional requirements beyond HIPAA. Consult legal counsel for jurisdiction-specific compliance.

Frequently Asked Questions

A HIPAA consent form is a general acknowledgment that a patient has received the provider's Notice of Privacy Practices. A HIPAA authorization (this form) is a more specific document that gives permission for a particular disclosure of PHI beyond routine treatment, payment, or operations. Authorizations are required for disclosures to third parties such as attorneys, employers, and researchers.

Free HIPAA Consent Form — Fill Out & Download Instantly

════════════════════════════════════════

HIPAA AUTHORIZATION FOR USE OR DISCLOSURE

OF PROTECTED HEALTH INFORMATION

45 CFR § 164.508

════════════════════════════════════════

I. COVERED ENTITY MAKING DISCLOSURE

II. RECIPIENT OF INFORMATION

III. DESCRIPTION OF INFORMATION AUTHORIZED FOR DISCLOSURE

IV. PURPOSE OF DISCLOSURE

V. EXPIRATION

VI. PATIENT RIGHTS

SIGNATURE

What Is a HIPAA Consent Form?

When Do You Need It?

What's Included in This Template

How to Fill It Out

Legal Requirements & Notes

Frequently Asked Questions

Related Templates

Medical Consent Form

HIPAA Business Associate Agreement (BAA)

Doctor's Note Template